Splunk Search

regex not working

reverse
Contributor

https://regex101.com/r/PNYxi2/2

not working in splunk.

Error in 'rex' command: Encountered the following error while compiling the regex '(?<v1>.+:\.+?\(.+?)\.+)': Regex: unmatched closing parenthesis
0 Karma
1 Solution

Vijeta
Influencer

@reverse - A backslash seems to be misplaced in your expression. It should be '(?<v1>.+:\.+?\(.+?\).+)':

View solution in original post

Vijeta
Influencer

@reverse - A backslash seems to be misplaced in your expression. It should be '(?<v1>.+:\.+?\(.+?\).+)':

View solution in original post

jazzypai
Path Finder

Try out the following as for regex101.com

(?<drive>\w)\:\\(?<first>[\w]+)\\(?<second>[\w]+)\\(?<third>[\w]+)\\(?<filename>[\d\w\.]+)

Try this out in splunk;

 | rex field=string "(?<drive>\w)\:\\\(?<first>[\w]+)\\\(?<second>[\w]+)\\\(?<third>[\w]+)\\\(?<filename>[\d\w\.]+)"

This will parse the entire path that you listed.

saurabhkharkar
Path Finder

what are you trying to parse ?

0 Karma

reverse
Contributor

I want to extract DEF.

0 Karma

reverse
Contributor
0 Karma

jazzypai
Path Finder

Do you want to extract DEF or do you want to extract the name of the second directory, where DEF is located?

0 Karma

reverse
Contributor

name of the second directory

0 Karma

saurabhkharkar
Path Finder
| makeresults
| eval string ="c:\ABC\DEF\LOGS\1.LOG"
| rex field=string ".*?\\\\\w+\\\(?<extract_attribute>\w+).+"
| table string extract_attribute
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.